A network device should be identified by the decision it makes
A modern appliance may switch frames, route packets, filter traffic, translate addresses, provide DHCP, and host wireless radios in one enclosure. That can make device-identification questions confusing if you memorize product names. A stronger method is to ask: what decision must occur at this point in the packet path?
AP Networking rule
Name the function first. Then, if the scenario gives a multifunction product, explain which function inside that product is relevant to the evidence.
One user flow may touch several device roles in sequence
If same-subnet communication works but the default gateway does not, the remote firewall is not yet the first useful suspect. If the gateway receives the packet and the firewall logs a deny, the investigation has advanced to policy. Device function tells you which artifact should exist at each stage.
MAC learning explains ordinary Ethernet forwarding
A switch learns the source MAC address of arriving frames and associates that address with an ingress port. For known unicast destinations, it forwards toward the learned destination port. Unknown unicast and broadcast traffic are flooded within the relevant VLAN, excluding the ingress port.
A MAC learned on the wrong uplink can expose a topology or cabling surprise
Routing tables answer the “where does this remote packet go?” question
The router compares the destination IP with available prefixes and selects the most specific matching route. The outgoing Layer 2 frame changes hop by hop, while the IP destination normally remains the remote host unless features such as translation change addressing.
Wireless association is only the first checkpoint
An access point provides wireless Layer 2 connectivity and typically bridges clients into a wired VLAN. A client can associate and authenticate successfully yet still fail DHCP, VLAN forwarding, gateway reachability, DNS, or Internet access.
The radio connection is established, but the remaining evidence points toward the AP's VLAN mapping, wired uplink, DHCP path, or client-specific behavior rather than “Wi-Fi cannot connect at all.”
A wired comparison can remove the radio link from the path
Routing success does not equal policy permission
A firewall evaluates traffic against policy. Depending on the platform, rules may match source/destination addresses, protocol, ports, zones, interfaces, state, users, applications, or other attributes.
A deny log is stronger evidence than “the firewall might be blocking it”
The endpoint interface has both Layer 2 and Layer 3 evidence
A NIC can expose link state, negotiated rate, duplex, MAC address, errors, driver state, and IP configuration. A host may have several interfaces at once—Ethernet, Wi-Fi, VPN, virtual adapters—and the operating system can choose routes based on metrics and destination prefixes.
The interface carrying the flow depends on route selection, not simply which adapter looks “connected” in the UI.
A green link light is not proof of a healthy gigabit path
Twisted-pair Ethernet depends on endpoint capability, cable construction and condition, termination quality, distance, and negotiation. A damaged cable can sometimes maintain link while negotiating a lower rate or accumulating physical errors.
“Link up” and “link healthy” are different claims
| Artifact | What it suggests | What to compare |
|---|---|---|
| CRC/FCS errors rising | Frame corruption on physical/link path | Cable, transceiver, port, neighbor counters |
| Negotiated speed lower than expected | Capability or physical-quality issue | Both endpoints + media |
| Output drops rising at high utilization | Queue congestion rather than corruption | Utilization, queue counters, loaded latency |
| Link transitions rising | Flapping physical/link state | Cable, optic, power, port logs |
Swipe horizontally to compare link artifacts.
Optics add compatibility dependencies that copper does not have
A fiber link depends on transceiver type, wavelength, fiber type, connector, polarity, supported rate, and far-end compatibility. An administratively enabled port can remain operationally down if the optic/fiber path is incompatible or physically broken.
Data configuration can be correct while power is the actual failure
Power over Ethernet can power access points, phones, cameras, and other devices. The switch has both per-port constraints and a total PoE budget.
A rebooting AP is not automatically a VLAN or IP problem. PoE status is a high-value infrastructure artifact because insufficient power can destabilize an otherwise correctly configured data path.
One connection can become a shared failure domain for dozens of devices
If the uplink fails physically, many downstream clients can lose remote connectivity simultaneously while same-switch, same-VLAN communication may continue. If only VLAN 20 fails across the uplink while VLAN 10 still works, the physical link is not completely dead; logical VLAN/trunk configuration becomes stronger.
LAN technology and WAN technology may be different layers of the same user path
Cable modems, fiber ONTs, DSL equipment, and cellular gateways connect the customer edge to a provider service. Some devices act mostly as handoffs; others route, NAT, filter, or provide Wi-Fi.
Two routing/NAT devices can create a second translation boundary
Outbound browsing may still work, but inbound services, some peer-to-peer applications, gaming, VPNs, and troubleshooting become more complex because two devices maintain separate translation state.
Ask each device the question it is best positioned to answer
| Device / component | Best artifact | Question answered | What remains outside its proof |
|---|---|---|---|
| Switch | MAC table, VLAN/trunk state, port counters | Where frames are learned/forwarded and whether link/VLAN state is healthy | Remote route, DNS, application state |
| Router | Route table, ARP/neighbor, interface state | Which Layer 3 path is selected | Firewall permission and return path beyond shown evidence |
| AP | Association/authentication, radio stats, SSID/VLAN mapping | Whether wireless attachment is healthy | DHCP/routing/application beyond AP path |
| Firewall | Rulebase + logs/state | Whether the exact flow is permitted/denied | Whether endpoints/services are correctly configured |
| NIC | Link/negotiation/errors/IP/route | Endpoint interface health and local configuration | Remote infrastructure |
| Provider handoff | Signal/session/service state | Whether customer edge has provider service | Internal LAN correctness |
Swipe horizontally to inspect the evidence matrix.
Same-subnet peers work; default gateway fails
Only one access port accumulates physical errors
The evidence localizes strongly toward the Gi1/0/12 physical path—cable, termination, port, or attached NIC—rather than a switch-wide or core-wide failure.
Wireless associates, but DHCP never arrives
The AP's radio/authentication functions are working sufficiently for attachment. The next useful evidence is SSID-to-VLAN mapping, AP wired uplink/trunk state, DHCP relay/scope, and client-specific path evidence.
Firewall denies the exact HTTPS flow
The strongest evidence is now policy. Changing DNS, replacing the switch, or altering the client's gateway ignores a demonstrated deny at the policy boundary.
One changed artifact should change the device you investigate
| Original evidence | Changed fact | Reasoning shift |
|---|---|---|
| One port has rising CRC errors | All ports now show identical errors | Broaden beyond one cable/NIC toward shared switch/uplink/power/environmental factors |
| Wi-Fi client fails DHCP; wired works | Wired control also fails DHCP | Wireless-only branch weakens; shared DHCP/VLAN/gateway path becomes stronger |
| VLAN 20 fails across uplink | VLAN 10 and 30 also fail | Physical/trunk-wide failure becomes stronger than selective VLAN configuration |
| Firewall log shows deny | Rule is changed and permit log appears, but app still fails | Move past policy to route/return path/TLS/application |
| Provider handoff has no signal | Provider signal returns but LAN clients still fail gateway | WAN handoff no longer explains the remaining LAN failure |
Swipe horizontally to practice changed-fact reasoning.
Correct these device-identification mistakes
- “Router means every feature in a home gateway.” Separate routing, NAT, DHCP, Wi-Fi, and firewall functions.
- “AP association means Internet works.” Association is only the wireless attachment checkpoint.
- “Link light means healthy Ethernet.” Negotiated rate and error counters matter.
- “A firewall is just a router with rules.” Routing and policy are distinct decisions even when integrated into one appliance.
- “Two links always add redundancy safely.” Layer 2 redundancy requires loop-safe design or aggregation.
- “PoE is unrelated to networking.” Power failure can take the network device offline even when data configuration is correct.
- “Fiber problems are solved like copper problems.” Optics, wavelength, fiber type, polarity, and optical levels add unique dependencies.
- “Replace the biggest box first.” Replace or repair the failed function supported by evidence.
Use FUNCTION → PATH → ARTIFACT → LIMIT → NEXT DEVICE
24 interactive Topic 3.1 reasoning flashcards
These cards test device function, artifacts, media, PoE, switching, routing, wireless, policy, and troubleshooting boundaries.